Skip to main content
This guide walks you through a fully zero-touch deployment of the Origin macOS agent using Tanium. Tanium Device Management pushes the PPPC configuration profile that pre-approves the permissions the agent needs. Tanium Deploy then stages the provisioning JWT and installs the agent — but only on endpoints where the profile has been confirmed installed. Together they create a self-healing, ongoing pipeline: new Macs enroll, receive the profile, and automatically receive the agent with no manual intervention.

​
Overview

Deploying the Origin agent on macOS requires two Tanium products working in sequence:
  • Tanium Device Management pushes the MDM configuration profile that pre-approves the permissions the agent needs. Without it, the agent hits interactive permission dialogs during registration and silent install fails.
  • Tanium Deploy stages the provisioning JWT and executes the installer, but only on endpoints where the profile has successfully installed.
The two products are independent — Device Management uses Apple’s MDM/APNs channel, Deploy uses the Tanium Client. Both must be in place before the agent install runs.

​
Prerequisites

  • Tanium Cloud admin access with permissions to configure Device Management (Shared Services → Device Management) and Deploy (Modules → Deploy).
  • A Tanium licence that includes Tanium Enforce (required by Device Management).
  • An Apple Push Notification Service (APNs) certificate configured in Device Management — Shared Services → Device Management → Settings → Push Certificate.
  • Target Macs enrolled in Tanium Device Management (see Step 1).
  • A valid Origin provisioning JWT — obtain from the Origin console under Settings → Provisioning Tokens.
  • The Origin macOS installer (Origin.pkg) — download from the Origin console under Settings → Installers.
  • The origin-privacy.mobileconfig profile from the deployment package.
The installer and the provisioning token live in two different Settings views — Installers for the .pkg, Provisioning Tokens for the JWT. Tokens carry an expiry and a use limit, so confirm both cover your rollout.
Deployment package download: drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF

​
Files

The bundle may also contain a proxy root CA template, a system-extensions policy, and a VPN/transparent-proxy profile from Origin’s earlier proxy-based capture architecture. Do not deploy these — they are no longer required.
Identifiers

​
Deployment order

The configuration profile must reach Installed status on the endpoint before the Deploy package runs. The Deploy deployment is gated on this via a computer group (Step 4) — it will not run on a Mac until the profile is confirmed installed.
1

Enroll Macs in Device Management

Macs must be enrolled in Tanium Device Management before profiles can be pushed. Enrollment also automatically installs the Tanium Client, which Deploy requires.If your Macs are purchased through Apple Business Manager (ABM) or Apple School Manager (ASM), configure automated device enrollment so Macs enroll at setup time with no user interaction.
  1. Go to Shared Services → Device Management → Settings (GEAR icon, not the side menu) → Automated Enrollment.
  2. Follow the prompts to link your ABM/ASM token and configure the enrollment experience.

​
Manual enrollment (testing / pilot)

For individual Macs not in ABM, download and install the enrollment profile manually:
  1. Go to Shared Services → Device Management → Settings (GEAR icon, not the side menu) → Device Enrollment.
  2. In the Manual Enrollment section, click Download and select the macOS enrollment file.
  3. Copy the profile to the target Mac and install it.
  4. On the Mac, open the profile in System Settings and confirm installation.
Once enrolled, the Tanium Client installs automatically. Verify enrollment by checking that the Mac appears in Shared Services → Device Management with a recent check-in time.Alternatively, ask the following question in Tanium Interact to verify enrollment:
2

Upload the Configuration Profile

The profile is uploaded as a Custom Setting in Tanium Device Management, which pushes it via the MDM/APNs channel.
Do not recreate this profile using Tanium Enforce’s built-in payload editors. The editors rewrite the XML and could break the code requirement in the PPPC profile. Upload the raw .mobileconfig only.
  1. Go to Shared Services → Device Management → Settings.
  2. In the Custom Setting section, click +.
  3. Name the setting Origin - Privacy.
  4. In Choose a platform, select macOS.
  5. In Upload your profile, drag and drop origin-privacy.mobileconfig.
  6. Click Open, then Save.
Use this exact setting name. The computer group created in Step 4 matches against it in sensor output. If the name differs, the condition will not match and the Deploy package will never fire.
3

Create the Collection

A Device Management collection groups the setting and targets it to the appropriate devices.
  1. Go to Shared Services → Device Management → Collections.
  2. Click Add Collection.
  3. Name the collection Origin Agent - Profiles.
  4. Click Add for the Origin - Privacy setting and click Next.
  5. Skip the Applications step and click Next.
  6. Configure targeting — select the computer group containing your target Macs.
  7. Click Preview Targeted Endpoints to verify scope, then Save.
Allow a few minutes for the profile to push via MDM. Monitor progress on the collection’s Overview tab — the setting should reach Installed before proceeding to Step 4.

​
Verify on the endpoint

Before building the Deploy package, confirm the profile is installed on a test endpoint:
In Tanium Interact, confirm the sensor output — run this question against your test Mac:
You should see output like:
4

Create the Computer Group

The Deploy deployment is scoped to this computer group. A Mac joins it only when the Origin profile is confirmed installed — this is the gate that prevents the Deploy package from running on unprepared endpoints.
  1. Go to Administration → Computer Groups.
  2. Click New Computer Group.
  3. Name it Origin Profiles Installed.
  4. Set the filter expression to:
  1. Click Preview to confirm your test Mac appears in the group.
  2. Click Save.
How the regex works: the condition matches a row in the sensor output that begins with the profile name, followed by a pipe delimiter (with optional whitespace), followed by Installed. This confirms both the profile name AND its status together — a condition like contains "Installed" alone would match any profile that happens to be installed, not the specific one named.
5

Create the Deploy Package

A single Deploy software package with three sequential commands handles JWT staging, installation, and cleanup.

​
Package details

  1. Go to Modules → Deploy → Software → Software Packages.
  2. Click Create Package.
  3. Fill in the package details:

​
Package files

In the Package Files section, upload both files:
  • Origin.pkg
  • jwt.txt — a plain text file containing your provisioning JWT (just the token string, no newline)
jwt.txt is uploaded as a package file so Deploy distributes it to the endpoint before any commands run. The JWT never appears in the command body and is therefore not visible to admins browsing package details.

​
System requirements

  • Architecture: Universal
  • Minimum OS: Origin’s supported macOS floor — see Agent Overview

​
Install operation

Enable the Install operation and ensure Require Source Files is selected. Add three sequential Run Commands:Command 1 — Stage the JWT
Copies jwt.txt to the path the postinstall expects, read-only by owner. Success code: 0.Command 2 — Install Origin
Success code: 0.Command 3 — Clean up the JWT
Success code: 0.If Command 1 or 2 fails, Deploy will not proceed to the next command. Note that the staged file has mode 400 (root read-only), so it is not readable by other processes even if the installer fails and leaves it behind.

​
Installation requirements

Ensures the package only runs on Macs that do not already have Origin installed:

​
Install verification

Confirms Origin installed successfully:

​
Save the package

Click Create Package and wait for Status to reach 100% before deploying.
6

Create the Deployment

  1. Go to Modules → Deploy → Deployments and click New Deployment.
  2. Select Software Package and choose Origin Agent - Install (macOS).
  3. Select Install as the operation.
  4. In Endpoints to Target, select the Origin Profiles Installed computer group.
  5. Set Deployment Type to Ongoing — this ensures newly enrolled Macs automatically receive the agent once their profile reaches Installed status.
  6. Configure a maintenance window if required by your change management policy.
  7. Click Deploy.
The ongoing deployment combined with the dynamic computer group makes this fully zero-touch for new Macs: a Mac enrolls in Device Management → the profile pushes via MDM → it reaches Installed → the Mac joins the Origin Profiles Installed group → Deploy fires automatically.
7

Verification

​
Deploy job status

Open the deployment in Modules → Deploy → Deployments and confirm the endpoint shows Installed status.

​
Profile installed

​
Agent process running

Returns a PID when the agent is running.

​
JWT cleaned up

Expected: No such file or directory

​
Agent log

Confirms the agent started cleanly and registration succeeded.

​
Origin console

In the Origin console, go to Settings → Endpoint Inventory and search for the target hostname. A successfully registered endpoint appears with a recent last-seen time and its detected AI agents populated.
8

Troubleshooting

​
Profile shows Failed or Pending in Device Management

Check the setting status on the collection’s Devices tab.
  • Profile XML was modified or recreated using a payload editor — re-upload the raw .mobileconfig from the deployment package.
  • Profile stuck Pending — trigger an MDM check-in from the device’s Endpoint Details page using Deploy Action → Refresh Device Data, or wait for the next scheduled check-in.

​
Mac not appearing in the Origin Profiles Installed computer group

Run the sensor question manually in Interact to confirm the output format matches the regex:
If the profile name in the output differs from Origin - Privacy, update the computer group regex to match the actual name.

​
Full Disk Access not granted despite profile

The PPPC profile’s code requirement matches Developer ID signed builds with Team ID D3C73MWD7Y. Ad-hoc signed or internal development builds won’t match and Full Disk Access will not pre-grant.

​
JWT prompt appears during install (non-silent install)

The installer postinstall did not find the staged JWT. Check:
  1. Command 1 (install -m 400 jwt.txt /var/tmp/origin-provisioning-jwt) completed with exit code 0 — check the Deploy job log.
  2. jwt.txt was uploaded to the package files and Require Source Files is enabled on the Install operation.
  3. jwt.txt contains only the JWT string with no trailing newline or whitespace.
  4. The token has not expired or exhausted its use limit — check Settings → Provisioning Tokens.

​
Deploy package shows Not Applicable

The Installation Requirements rule (/Applications/Origin.app does not exist) is evaluating as not met — meaning Origin is already installed on the endpoint. Check the endpoint in the Origin console to confirm whether it is already registered.

​
Origin not appearing in Origin console after install

  • Confirm outbound HTTPS (port 443) from the endpoint to the Origin cloud backend is not blocked by proxy or firewall. See Network Connectivity.
  • Check the agent log: cat /Library/Origin/logs/agent.log.$(date -u +%Y-%m-%d)
  • Confirm the JWT in jwt.txt was valid and had not expired at install time.
9

Maintenance

​
Updating the Origin agent

  1. Download the new Origin.pkg from the Origin console.
  2. Edit the Origin Agent - Install (macOS) package in Deploy — replace Origin.pkg in Package Files and increment the version.
  3. Update the Install Verification if the app version changes.
  4. The ongoing deployment automatically pushes the update to enrolled endpoints.

​
Rotating the provisioning JWT

  1. Create a new token in the Origin console under Settings → Provisioning Tokens.
  2. Create a new jwt.txt containing the new token.
  3. Edit the Deploy package — replace jwt.txt in Package Files and increment the version.
  4. Existing registered agents are not affected — they maintain their own session credentials after initial registration. Only endpoints receiving a fresh install will use the updated token.

​
Removing the agent

An uninstall.sh script is bundled inside the app:
Add a Remove operation to the Deploy package using this command and deploy to the target computer group.

​
Mac Device Enrollment deprecation

Tanium Mac Device Enrollment is deprecated as of December 2025 and sunsets September 2026. If your environment currently uses Mac Device Enrollment, migrate to Tanium Device Management before implementing this guide. See the Tanium Endpoint Management for Mobile User Guide for migration steps.